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REMARKS 



This paper is responsive to the Office Action dated March 24, 2003. Claims 1 - 38 were 
rejected. Claims 1-38 have not been amended and remain pending. 



The Office Action rejects claims 1 -14, 17-25,and 27 - 38 under 35 U.S.C. § 102(e) as 
being anticipated by U.S. Patent 6,275,941 BI, granted to Saito, et al. (the Saito reference). 
Applicant respectfully traverses all of these rejections. 

The Saito reference does not disclose a relationship between ''credential types" and 
"trust-level" requirements for information resources, and hence cannot disclose their use or 
exploitation as claimed. All of Applicant's independent claims recite a correspondence or 
association between ^'credential types" and "trust-levels," The Office Action apparently 
assimies that these features are described by the Saito reference, but they are never discussed in 
the Saito reference or any other art of record. 

Since a correspondence between credential types and trust level requirements is not 
expressly shown in the Saito reference. Applicant must presume that the Office Action intends to 
rely on the doctrine of inherency. Applicant respectfully notes that "anticipation by inherent 
disclosure is appropriate only when the reference discloses prior art that must necessarily include 
the unstated limitation" (Transclean Corp. v. Bridgewood Serv. Inc. . 290 F.3d 1367 (Fed. Cir. 
2002), citins^ Continental Can Co. v. Monsanto Co. . 948 F.2d 1264, 1268-69 (Fed. Cir. 1991)). 
*To establish inherency, the extrinsic evidence 'must make clear that the missing descriprive 
matter is necessarily present in the thing described in the reference, and that it would be so 
recognized by persons of ordinary skill'" (In re Roberston , 169 R3d 743 (Fed. Cir. 1999), 
Quotins Continental Can Co. v. Monsanto Co., 948 F.2d 1264, 1268 (Fed. Cir. 1991)). 
"Inherency, however, may not be established by probabilities or possibilities. The mere fact that 
a certain thing may result from a given set of circumstances is not sufficient" (Id. at 1 269, 
quoting In re Oehrich . 666 F.2d 578, 581 (C.C.P.A. 1981)), Applicant respectfully submits that 
none of these requirements for the Doctrine of Inherency are met with respect to Applicant's 
claims and any of the art of record. 
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The Saito reference describes a server for managing security informalion retrieving login 
information (user identifier and a password) with an integrated certificate that is input by a user, 
and providing the login credentials to the application server for determining access level of the 
user (Figures 5-6, col. 7 line 5 -- col. 8, line 63). If an integrated certificate is considered an 
instance of a first type of credential, and login credentials are an instance of a second type of 
credential, then the Saito reference describes using an instance of a first credential type for a 
specific user to retrieve an instance of a second credential type for the user, and determining an 
access level for that user with the instance of the second credential type. The Saito reference 
never discloses or suggests a relationship between credential types and trust levels. 

Specifically, the Saito reference does not disclose or suggest "a mapping rule 
estabiistiing a correspondence between the sufiicient trust-level and a set of suitable 
credential types" as required by claim 1, "an encoding of correspondence between trust-levels 
and credential types" as required by claim 7, ^'associating credential types with trust-levels" 
as required by claims 24 and 36, and "selecting from plural credential types, a credential type 
having an associated trust-level commensurate with the first trust-level requirement" as 
required by claim 28. 

The Office Action seems to assume that an integrated certificate of the Saito reference is 
"credential types" as required by Applicant's independent claims. The integrated certificate 
described in the Saito reference is a specific digital certificate that corresponds to a particular 
user (Figures 3 and 5 - 8, col. 5, lines 32 - 55, col 7, lines 25 - 30, col. 8, lines 6 - 25, col. 9, 
lines 16 - 22) and is not the same as ''credential types." An integrated certificate may be an 
instance of one type of credential, but it is not ''credential types." As a result, there is simply no 
correspondence between a credential type and a trust level. 

The Office Action also assumes that "access level" as used in the Saito reference, is (are) 
the "trust-level(s)" recited by Applicant's claims. Throughout the Saito reference, the term 
"access level" is used with reference to the level of access afforded to a particular user 
attempting to access a document (col. 6, lines 20 -22, col. 7, lines 44 - 56 and 63 ~ 67, and col. 9, 
lines 23 - 26). Unlike Saito 's access levels (which follow from a user's login credentials), 
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Applicants' "trust-levels" encode access requirements for information resources for which a 
given credential type (not a given user's login credentials) may be sufficient to establish 
appropriate authority. 

For at least the reasons stated above, Applicant respectfully submits that Applicant's 
independent claims, and those that depend therefrom are allowable over the Saito reference and 
any other art of record. 



The Office Action rejects claims 15 and 16 under U.S.C. § 103(a) as being unpatentable 
over the Saito reference in view of U.S. Patent 5,610,981, granted to Mooney, et aL (the Mooney 
reference). The Office Action also rejects claim 26 under U.S.C. § 103(a) as being unpatentable 
over the Saito reference in view of the publication WO 98/25373, listing an inventor Glogau (the 
Glogau reference). Applicant respectfully traverses all of these rejections. 

The dependent claims 15, 16, and 26 depend on corresponding ones of the above 
allowable independent claims, and therefore are also allowable. Moreover, Applicant notes that 
as with the Saito reference, the Office Action seems to misinterpret the disclosure contents of the 
Mooney reference and the Glogau reference. The Office Action seems to mistakenly interpret 
the user access privilege level disclosed in the Mooney reference as being similar to a trust level 
requirement, which it is not. Neither the Saito reference nor the Mooney reference, taken alone 
or in combination, renders claims 1 5 or 16 obvious. 

With regard to the Glogau reference, the reference simply does not disclose what the 
Office Action suggests. In particular, there is no correspondence between credential types and 
trust levels and no obtaining of a first credential (with insufficient associated trust level), let 
alone an "addition credential" having an associated trust level commensurate with a requirement. 
Accordingly, neither the Saito reference nor the Glogau reference, taken alone or in combination, 
render claim 26 obvious. 

Moreover, all of the dependent claims 2 - 6, 8 - 23, 25 - 27, 29 - 35, and 37 - 38 are 
dependent on one of the above allowable independent claims. Applicant respectfully submits 
that all of the dependent claims are allowable. 
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Conclusion 

In summary, claims 1 - 38 are in the case. All claims are believed to be allowable over 
the art of record, and a Notice of Allowance to that effect is respectfully solicited. Nonetheless, 
if any issues remain that could be more efficiently handled by telephone, the Examiner is 
requested to call the undersigned at the number listed below. 



CKRTIFICATE OF MAILINC OK TRANSMISSION 

I hereby certify that, on the date shown below, this 
correspondence is being 

□ deposited with the US Postal Service wiih suHlcient postage 
as first class mail, in an envelope addtx^sed to Commissioner 
for Patents, P. O. Box 1 450, Alexandria, VA 223 J 3. 

S facsimile transmitted to the US Patent and Trademark Otiricc. 




Steven R. Gilliam 



Date 
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Respectfully submitted. 




Steven R. Gilliam, Reg. No. 51,734 
Attorney for Applicant(s) 
(512) 347-9030 
(512)347-9031 (fax) 



reiponse to J-24.0i na 004-36:^ ) ^ fBctJ due 

Received from < 512 347 9031 > at B/23/03 6:25:59 PM [Eastern DayOght Time] 



-7- 



Application No.: 09/368,507 



